evaluate: don't allow nat map with specified protocol

Included bogon asserts:
src/netlink_linearize.c:1305: netlink_gen_nat_stmt: Assertion `stmt->nat.proto == NULL' failed.

The comment right above the assertion says:
  nat_stmt evaluation step doesn't allow
  STMT_NAT_F_CONCAT && stmt->nat.proto.

... except it does allow it.  Disable this.

Fixes: c68314dd4263 ("src: infer NAT mapping with concatenation from set")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/src/evaluate.c b/src/evaluate.c
index 95b9b3d547d99dc41f0301a2da0933a571e8c77c..3a453d010538560cfcadaa927a22bcd390c6603b 100644 (file)
--- a/src/evaluate.c
+++ b/src/evaluate.c
@@ -4196,6 +4196,10 @@ static int stmt_evaluate_nat_map(struct eval_ctx *ctx, struct stmt *stmt)
        int addr_type;
        int err;
 
+       if (stmt->nat.proto)
+               return stmt_binary_error(ctx, stmt, stmt->nat.proto,
+                                 "nat map and protocol are mutually exclusive");
+
        if (stmt->nat.family == NFPROTO_INET)
                expr_family_infer(pctx, stmt->nat.addr, &stmt->nat.family);
 

diff --git a/tests/shell/testcases/bogons/nat_map_and_protocol_assert b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
new file mode 100644 (file)
index 0000000..67f2ae8
--- /dev/null
+++ b/tests/shell/testcases/bogons/nat_map_and_protocol_assert
@@ -0,0 +1,5 @@
+table t {
+ chain y {
+  snat to ip saddr . tcp sport map { 1.1.1.1 . 1 : 1.1.1.2 . 1 } : 6
+ }
+}